@heavybit/shared-lib 1.3.2 → 2.7.0

package/dist/cjs/database/scopes.js

@@ -0,0 +1,166 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PlatformScopeDefinition = exports.PlatformScope = exports.OwnerScope = void 0;
+exports.resolveColumn = resolveColumn;
+exports.defineScope = defineScope;
+exports.definePlatformScope = definePlatformScope;
+const drizzle_orm_1 = require("drizzle-orm");
+const errors_js_1 = require("../common/errors.js");
+/**
+ * Finds a table column by its database name.
+ *
+ * @throws Error when the table has no such column (a wiring bug, caught at startup or in tests).
+ */
+function resolveColumn(table, dbName) {
+    const columns = (0, drizzle_orm_1.getTableColumns)(table);
+    for (const [key, column] of Object.entries(columns)) {
+        if (column.name === dbName)
+            return { key, column };
+    }
+    throw new Error(`Table has no column "${dbName}"`);
+}
+function requireValue(value, scopeName, code) {
+    if (typeof value !== 'string' || value.trim() === '') {
+        throw new errors_js_1.ForbiddenError(`A ${scopeName} scope is required`, { code });
+    }
+    return value;
+}
+/** Sets `column` on `row` to `value`; refuses a row that carries a different value. */
+function stampColumn(table, row, dbName, value, scopeName) {
+    const { key } = resolveColumn(table, dbName);
+    const current = row[key];
+    if (current !== undefined && current !== null && current !== value) {
+        throw new errors_js_1.ForbiddenError(`Row belongs to another ${scopeName}`, { code: 'SCOPE_MISMATCH' });
+    }
+    return { ...row, [key]: value };
+}
+/**
+ * Defines a scope whose value comes from the request context (the gateway-signed identity, never a
+ * request body).
+ *
+ * @example const workspaceScope = defineScope({ name: 'workspace', column: 'workspace_id', contextKey: 'workspaceId' });
+ */
+function defineScope(options) {
+    const { name, column, contextKey } = options;
+    const valueOf = (ctx) => requireValue(ctx?.[contextKey], name, 'SCOPE_REQUIRED');
+    return Object.freeze({
+        name,
+        column,
+        contextKey,
+        valueOf,
+        condition: (table, ctx) => (0, drizzle_orm_1.eq)(resolveColumn(table, column).column, valueOf(ctx)),
+        stamp: (table, row, ctx) => stampColumn(table, row, column, valueOf(ctx), name),
+    });
+}
+/**
+ * Rows owned by one principal (e.g. a user's own records). Refuses a missing owner id, so an
+ * anonymous call can never fall through to "all owners".
+ *
+ * @example const ownerScope = new OwnerScope({ name: 'owner', column: 'user_id' });
+ */
+class OwnerScope {
+    /** Readable name (e.g. `owner`). */
+    name;
+    /** Database name of the owner column (e.g. `user_id`). */
+    column;
+    /** @param options `name` for messages, `column` = database name of the owner column. */
+    constructor(options) {
+        this.name = options.name;
+        this.column = options.column;
+    }
+    /** The owner id from `ctx`; throws ForbiddenError (`OWNER_REQUIRED`) when it is missing. */
+    ownerIdOf(ctx) {
+        return requireValue(ctx?.ownerId, this.name, 'OWNER_REQUIRED');
+    }
+    /** `owner column = ownerId`. @throws ForbiddenError (`OWNER_REQUIRED`) without an owner id. */
+    condition(table, ctx) {
+        return (0, drizzle_orm_1.eq)(resolveColumn(table, this.column).column, this.ownerIdOf(ctx));
+    }
+    /** Sets the owner column. @throws ForbiddenError (`OWNER_REQUIRED`, `SCOPE_MISMATCH`). */
+    stamp(table, row, ctx) {
+        return stampColumn(table, row, this.column, this.ownerIdOf(ctx), this.name);
+    }
+}
+exports.OwnerScope = OwnerScope;
+const ISSUE = Symbol('PlatformScope.issue');
+/**
+ * Proof that an identity may act across scopes. Only {@link PlatformScopeDefinition.authorize} can
+ * create one, and only when the definition's predicate approves the identity.
+ */
+class PlatformScope {
+    #definition;
+    /** @internal Use `definePlatformScope(...).authorize(identity)`. */
+    constructor(token, definition) {
+        if (token !== ISSUE)
+            throw new errors_js_1.ForbiddenError('Platform scope must be authorized', { code: 'PLATFORM_SCOPE_REQUIRED' });
+        this.#definition = definition;
+    }
+    /** True when this grant was issued by `definition`. */
+    issuedBy(definition) {
+        return this.#definition === definition;
+    }
+}
+exports.PlatformScope = PlatformScope;
+/**
+ * Cross-scope access for platform operators. Rows of every scope are reachable, but the query still
+ * filters on the scope column (`IS NOT NULL`) and inserts must name their scope explicitly.
+ */
+class PlatformScopeDefinition {
+    /** Readable name (e.g. `platform`). */
+    name;
+    /** Database name of the scope column the platform scope spans. */
+    column;
+    #predicate;
+    /** Prefer {@link definePlatformScope}. */
+    constructor(options) {
+        this.name = options.name;
+        this.column = options.column;
+        this.#predicate = options.predicate;
+    }
+    /**
+     * Issues a {@link PlatformScope} for `identity`.
+     *
+     * @throws ForbiddenError (`PLATFORM_SCOPE_DENIED`) when the predicate refuses (or throws).
+     */
+    authorize(identity) {
+        let allowed = false;
+        try {
+            allowed = identity != null && this.#predicate(identity);
+        }
+        catch {
+            allowed = false;
+        }
+        if (!allowed)
+            throw new errors_js_1.ForbiddenError('Platform access is required', { code: 'PLATFORM_SCOPE_DENIED' });
+        return new PlatformScope(ISSUE, this);
+    }
+    /** `scope column IS NOT NULL`. @throws ForbiddenError (`PLATFORM_SCOPE_REQUIRED`) without a grant from this scope. */
+    condition(table, ctx) {
+        this.assertGrant(ctx);
+        return (0, drizzle_orm_1.isNotNull)(resolveColumn(table, this.column).column);
+    }
+    /** Requires the row to name its scope. @throws ForbiddenError (`PLATFORM_SCOPE_REQUIRED`, `SCOPE_REQUIRED`). */
+    stamp(table, row, ctx) {
+        this.assertGrant(ctx);
+        const { key } = resolveColumn(table, this.column);
+        requireValue(row[key], this.name, 'SCOPE_REQUIRED');
+        return row;
+    }
+    assertGrant(ctx) {
+        if (!(ctx instanceof PlatformScope) || !ctx.issuedBy(this)) {
+            throw new errors_js_1.ForbiddenError('Platform access is required', { code: 'PLATFORM_SCOPE_REQUIRED' });
+        }
+    }
+}
+exports.PlatformScopeDefinition = PlatformScopeDefinition;
+/**
+ * Defines the platform (cross-scope) scope.
+ *
+ * @example
+ * const platformScope = definePlatformScope({ name: 'platform', column: 'workspace_id', predicate: (u: AuthUser) => u.isSuperAdmin });
+ * const grant = platformScope.authorize(req.user); // throws 403 for anyone else
+ */
+function definePlatformScope(options) {
+    return new PlatformScopeDefinition(options);
+}
+//# sourceMappingURL=scopes.js.map

package/dist/cjs/database/scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.js","sourceRoot":"","sources":["../../../src/database/scopes.ts"],"names":[],"mappings":";;;AA2EA,sCAMC;AAyBD,kCAYC;AAsID,kDAEC;AA9PD,6CAAuE;AAEvE,mDAAqD;AAoErD;;;;GAIG;AACH,SAAgB,aAAa,CAAC,KAAiB,EAAE,MAAc;IAC7D,MAAM,OAAO,GAAG,IAAA,6BAAe,EAAC,KAAK,CAAgC,CAAC;IACtE,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACrD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,GAAG,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,SAAiB,EAAE,IAAY;IACnE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,0BAAc,CAAC,KAAK,SAAS,oBAAoB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uFAAuF;AACvF,SAAS,WAAW,CAAuC,KAAiB,EAAE,GAAS,EAAE,MAAc,EAAE,KAAa,EAAE,SAAiB;IACvI,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACnE,MAAM,IAAI,0BAAc,CAAC,0BAA0B,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,WAAW,CAAsB,OAAqC;IACpF,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAC7C,MAAM,OAAO,GAAG,CAAC,GAAuB,EAAU,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAC7G,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI;QACJ,MAAM;QACN,UAAU;QACV,OAAO;QACP,SAAS,EAAE,CAAC,KAAiB,EAAE,GAAuB,EAAE,EAAE,CAAC,IAAA,gBAAE,EAAC,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAChH,KAAK,EAAE,CAAuC,KAAiB,EAAE,GAAS,EAAE,GAAuB,EAAE,EAAE,CACrG,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;KACtD,CAAC,CAAC;AACL,CAAC;AAOD;;;;;GAKG;AACH,MAAa,UAAU;IACrB,oCAAoC;IAC3B,IAAI,CAAS;IACtB,0DAA0D;IACjD,MAAM,CAAS;IAExB,wFAAwF;IACxF,YAAY,OAAyC;QACnD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,4FAA4F;IAC5F,SAAS,CAAC,GAAiB;QACzB,OAAO,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACjE,CAAC;IAED,+FAA+F;IAC/F,SAAS,CAAC,KAAiB,EAAE,GAAiB;QAC5C,OAAO,IAAA,gBAAE,EAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,0FAA0F;IAC1F,KAAK,CAAuC,KAAiB,EAAE,GAAS,EAAE,GAAiB;QACzF,OAAO,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,CAAC;CACF;AA1BD,gCA0BC;AAYD,MAAM,KAAK,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC;AAE5C;;;GAGG;AACH,MAAa,aAAa;IACf,WAAW,CAAiC;IAErD,oEAAoE;IACpE,YAAY,KAAmB,EAAE,UAA0C;QACzE,IAAI,KAAK,KAAK,KAAK;YAAE,MAAM,IAAI,0BAAc,CAAC,mCAAmC,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACxH,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC;IAChC,CAAC;IAED,uDAAuD;IACvD,QAAQ,CAAC,UAA0C;QACjD,OAAO,IAAI,CAAC,WAAW,KAAK,UAAU,CAAC;IACzC,CAAC;CACF;AAbD,sCAaC;AAED;;;GAGG;AACH,MAAa,uBAAuB;IAClC,uCAAuC;IAC9B,IAAI,CAAS;IACtB,kEAAkE;IACzD,MAAM,CAAS;IACf,UAAU,CAAmC;IAEtD,0CAA0C;IAC1C,YAAY,OAAwC;QAClD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;IACtC,CAAC;IAED;;;;OAIG;IACH,SAAS,CAAC,QAAsC;QAC9C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,QAAQ,IAAI,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,0BAAc,CAAC,6BAA6B,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACzG,OAAO,IAAI,aAAa,CAAC,KAAK,EAAE,IAAsC,CAAC,CAAC;IAC1E,CAAC;IAED,sHAAsH;IACtH,SAAS,CAAC,KAAiB,EAAE,GAAkB;QAC7C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtB,OAAO,IAAA,uBAAS,EAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7D,CAAC;IAED,gHAAgH;IAChH,KAAK,CAAuC,KAAiB,EAAE,GAAS,EAAE,GAAkB;QAC1F,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QACpD,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,WAAW,CAAC,GAAkB;QACpC,IAAI,CAAC,CAAC,GAAG,YAAY,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAsC,CAAC,EAAE,CAAC;YAC7F,MAAM,IAAI,0BAAc,CAAC,6BAA6B,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;CACF;AAjDD,0DAiDC;AAED;;;;;;GAMG;AACH,SAAgB,mBAAmB,CAAY,OAAwC;IACrF,OAAO,IAAI,uBAAuB,CAAC,OAAO,CAAC,CAAC;AAC9C,CAAC"}

package/dist/cjs/database/table-names.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OUTBOX_EXCHANGES = exports.SCHEDULER_RUN_STATUSES = exports.DEFAULT_SCHEDULER_RUNS_TABLE = exports.DEFAULT_PROCESSED_EVENTS_TABLE = exports.DEFAULT_OUTBOX_TABLE = void 0;
+/** Default name of the transactional outbox table. */
+exports.DEFAULT_OUTBOX_TABLE = 'event_outbox';
+/** Default name of the consumer idempotency ledger. */
+exports.DEFAULT_PROCESSED_EVENTS_TABLE = 'processed_events';
+/** Default name of the scheduled-job runs table. */
+exports.DEFAULT_SCHEDULER_RUNS_TABLE = 'scheduler_runs';
+/** Scheduler run states, shared by the Drizzle table and the Knex helper. */
+exports.SCHEDULER_RUN_STATUSES = ['running', 'succeeded', 'failed'];
+/** Logical exchanges an outbox row can target: topic events or direct commands. */
+exports.OUTBOX_EXCHANGES = ['events', 'commands'];
+//# sourceMappingURL=table-names.js.map

package/dist/cjs/database/table-names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"table-names.js","sourceRoot":"","sources":["../../../src/database/table-names.ts"],"names":[],"mappings":";;;AAAA,sDAAsD;AACzC,QAAA,oBAAoB,GAAG,cAAc,CAAC;AACnD,uDAAuD;AAC1C,QAAA,8BAA8B,GAAG,kBAAkB,CAAC;AACjE,oDAAoD;AACvC,QAAA,4BAA4B,GAAG,gBAAgB,CAAC;AAC7D,6EAA6E;AAChE,QAAA,sBAAsB,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAU,CAAC;AAClF,mFAAmF;AACtE,QAAA,gBAAgB,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAU,CAAC"}

package/dist/cjs/database/tables.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.schedulerRuns = exports.processedEvents = exports.outbox = exports.SCHEDULER_RUN_STATUSES = exports.OUTBOX_EXCHANGES = exports.DEFAULT_SCHEDULER_RUNS_TABLE = exports.DEFAULT_PROCESSED_EVENTS_TABLE = exports.DEFAULT_OUTBOX_TABLE = void 0;
+exports.outboxTable = outboxTable;
+exports.processedEventsTable = processedEventsTable;
+exports.schedulerRunsTable = schedulerRunsTable;
+const drizzle_orm_1 = require("drizzle-orm");
+const table_names_js_1 = require("./table-names.js");
+Object.defineProperty(exports, "DEFAULT_OUTBOX_TABLE", { enumerable: true, get: function () { return table_names_js_1.DEFAULT_OUTBOX_TABLE; } });
+Object.defineProperty(exports, "DEFAULT_PROCESSED_EVENTS_TABLE", { enumerable: true, get: function () { return table_names_js_1.DEFAULT_PROCESSED_EVENTS_TABLE; } });
+Object.defineProperty(exports, "DEFAULT_SCHEDULER_RUNS_TABLE", { enumerable: true, get: function () { return table_names_js_1.DEFAULT_SCHEDULER_RUNS_TABLE; } });
+Object.defineProperty(exports, "OUTBOX_EXCHANGES", { enumerable: true, get: function () { return table_names_js_1.OUTBOX_EXCHANGES; } });
+Object.defineProperty(exports, "SCHEDULER_RUN_STATUSES", { enumerable: true, get: function () { return table_names_js_1.SCHEDULER_RUN_STATUSES; } });
+const mysql_core_1 = require("drizzle-orm/mysql-core");
+/**
+ * Drizzle definitions of the infrastructure tables every service may own. Each matches the Knex
+ * helper of the same name in `@heavybit/shared-lib/knex` (`outboxColumns`, `processedEventsColumns`,
+ * `schedulerRunsColumns`); a test keeps the two in step. Pass a custom name when a service needs one.
+ */
+const ms = (name) => (0, mysql_core_1.datetime)(name, { mode: 'date', fsp: 3 });
+const createdNow = (name) => ms(name).notNull().default((0, drizzle_orm_1.sql) `CURRENT_TIMESTAMP(3)`);
+/** Transactional outbox (`event_outbox` by default): domain change and message in one transaction. */
+function outboxTable(name = table_names_js_1.DEFAULT_OUTBOX_TABLE) {
+    return (0, mysql_core_1.mysqlTable)(name, {
+        id: (0, mysql_core_1.char)('id', { length: 26 }).primaryKey(),
+        routingKey: (0, mysql_core_1.varchar)('routing_key', { length: 191 }).notNull(),
+        /** Logical exchange: `events` (topic fan-out) or `commands` (direct, one owner). */
+        exchange: (0, mysql_core_1.mysqlEnum)('exchange', table_names_js_1.OUTBOX_EXCHANGES).notNull().default('events'),
+        payload: (0, mysql_core_1.json)('payload').notNull(),
+        /** Correlation id of the request that staged the row; the relay sends it as `x-correlation-id`. */
+        correlationId: (0, mysql_core_1.varchar)('correlation_id', { length: 64 }),
+        attempts: (0, mysql_core_1.int)('attempts', { unsigned: true }).notNull().default(0),
+        lastError: (0, mysql_core_1.varchar)('last_error', { length: 500 }),
+        createdAt: createdNow('created_at'),
+        publishedAt: ms('published_at'),
+    }, (t) => [(0, mysql_core_1.index)(`${name}_published_at_id_index`).on(t.publishedAt, t.id)]);
+}
+/** Consumer idempotency ledger: one row per (consumer, event id). */
+function processedEventsTable(name = table_names_js_1.DEFAULT_PROCESSED_EVENTS_TABLE) {
+    return (0, mysql_core_1.mysqlTable)(name, {
+        id: (0, mysql_core_1.char)('id', { length: 26 }).primaryKey(),
+        consumer: (0, mysql_core_1.varchar)('consumer', { length: 191 }).notNull(),
+        eventId: (0, mysql_core_1.varchar)('event_id', { length: 64 }).notNull(),
+        processedAt: createdNow('processed_at'),
+    }, (t) => [
+        (0, mysql_core_1.uniqueIndex)(`${name}_consumer_event_id_unique`).on(t.consumer, t.eventId),
+        (0, mysql_core_1.index)(`${name}_processed_at_index`).on(t.processedAt),
+    ]);
+}
+/** Scheduled-job runs: one row per (job, run key), so a run is never executed twice. */
+function schedulerRunsTable(name = table_names_js_1.DEFAULT_SCHEDULER_RUNS_TABLE) {
+    return (0, mysql_core_1.mysqlTable)(name, {
+        id: (0, mysql_core_1.char)('id', { length: 26 }).primaryKey(),
+        job: (0, mysql_core_1.varchar)('job', { length: 191 }).notNull(),
+        runKey: (0, mysql_core_1.varchar)('run_key', { length: 191 }).notNull(),
+        status: (0, mysql_core_1.mysqlEnum)('status', table_names_js_1.SCHEDULER_RUN_STATUSES).notNull().default('running'),
+        error: (0, mysql_core_1.varchar)('error', { length: 500 }),
+        startedAt: createdNow('started_at'),
+        finishedAt: ms('finished_at'),
+    }, (t) => [
+        (0, mysql_core_1.uniqueIndex)(`${name}_job_run_key_unique`).on(t.job, t.runKey),
+        (0, mysql_core_1.index)(`${name}_job_started_at_index`).on(t.job, t.startedAt),
+    ]);
+}
+/** `event_outbox` with the default name. */
+exports.outbox = outboxTable();
+/** `processed_events` with the default name. */
+exports.processedEvents = processedEventsTable();
+/** `scheduler_runs` with the default name. */
+exports.schedulerRuns = schedulerRunsTable();
+//# sourceMappingURL=tables.js.map

package/dist/cjs/database/tables.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tables.js","sourceRoot":"","sources":["../../../src/database/tables.ts"],"names":[],"mappings":";;;AAuBA,kCAcC;AAGD,oDAUC;AAGD,gDAaC;AAlED,6CAAkC;AAClC,qDAAgK;AAYvJ,qGAZA,qCAAoB,OAYA;AAAE,+GAZA,+CAA8B,OAYA;AAAE,6GAZA,6CAA4B,OAYA;AAAE,iGAZA,iCAAgB,OAYA;AAAE,uGAZA,uCAAsB,OAYA;AAXrI,uDAAuH;AAEvH;;;;GAIG;AAEH,MAAM,EAAE,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAA,qBAAQ,EAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;AACtE,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAA,iBAAG,EAAA,sBAAsB,CAAC,CAAC;AAW3F,sGAAsG;AACtG,SAAgB,WAAW,CAAC,IAAI,GAAG,qCAAoB;IACrD,OAAO,IAAA,uBAAU,EAAC,IAAI,EAAE;QACtB,EAAE,EAAE,IAAA,iBAAI,EAAC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE;QAC3C,UAAU,EAAE,IAAA,oBAAO,EAAC,aAAa,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE;QAC7D,oFAAoF;QACpF,QAAQ,EAAE,IAAA,sBAAS,EAAC,UAAU,EAAE,iCAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC7E,OAAO,EAAE,IAAA,iBAAI,EAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QAClC,mGAAmG;QACnG,aAAa,EAAE,IAAA,oBAAO,EAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACxD,QAAQ,EAAE,IAAA,gBAAG,EAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAClE,SAAS,EAAE,IAAA,oBAAO,EAAC,YAAY,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACjD,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC;QACnC,WAAW,EAAE,EAAE,CAAC,cAAc,CAAC;KAChC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,kBAAK,EAAC,GAAG,IAAI,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,qEAAqE;AACrE,SAAgB,oBAAoB,CAAC,IAAI,GAAG,+CAA8B;IACxE,OAAO,IAAA,uBAAU,EAAC,IAAI,EAAE;QACtB,EAAE,EAAE,IAAA,iBAAI,EAAC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE;QAC3C,QAAQ,EAAE,IAAA,oBAAO,EAAC,UAAU,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE;QACxD,OAAO,EAAE,IAAA,oBAAO,EAAC,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE;QACtD,WAAW,EAAE,UAAU,CAAC,cAAc,CAAC;KACxC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;QACR,IAAA,wBAAW,EAAC,GAAG,IAAI,2BAA2B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC;QACzE,IAAA,kBAAK,EAAC,GAAG,IAAI,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;KACtD,CAAC,CAAC;AACL,CAAC;AAED,wFAAwF;AACxF,SAAgB,kBAAkB,CAAC,IAAI,GAAG,6CAA4B;IACpE,OAAO,IAAA,uBAAU,EAAC,IAAI,EAAE;QACtB,EAAE,EAAE,IAAA,iBAAI,EAAC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE;QAC3C,GAAG,EAAE,IAAA,oBAAO,EAAC,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE;QAC9C,MAAM,EAAE,IAAA,oBAAO,EAAC,SAAS,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE;QACrD,MAAM,EAAE,IAAA,sBAAS,EAAC,QAAQ,EAAE,uCAAsB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QAChF,KAAK,EAAE,IAAA,oBAAO,EAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACxC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC;QACnC,UAAU,EAAE,EAAE,CAAC,aAAa,CAAC;KAC9B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;QACR,IAAA,wBAAW,EAAC,GAAG,IAAI,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC;QAC7D,IAAA,kBAAK,EAAC,GAAG,IAAI,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC;KAC7D,CAAC,CAAC;AACL,CAAC;AAED,4CAA4C;AAC/B,QAAA,MAAM,GAAG,WAAW,EAAE,CAAC;AACpC,gDAAgD;AACnC,QAAA,eAAe,GAAG,oBAAoB,EAAE,CAAC;AACtD,8CAA8C;AACjC,QAAA,aAAa,GAAG,kBAAkB,EAAE,CAAC"}

package/dist/cjs/express/auth.js

@@ -1,72 +1,119 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.requireRole = exports.requireAllPermissions = exports.requirePermission = void 0;
+exports.requireRole = exports.requireOtpVerified = exports.requireAllPermissions = exports.requirePermission = void 0;
 exports.authenticateFromGateway = authenticateFromGateway;
 exports.optionalAuthFromGateway = optionalAuthFromGateway;
-exports.requireInternalServiceSecret = requireInternalServiceSecret;
 const index_js_1 = require("../access/index.js");
-const crypto_js_1 = require("../common/crypto.js");
 const response_js_1 = require("../common/response.js");
-const index_js_2 = require("../identity/index.js");
-function resolveIdentity(req, options) {
-    const result = (0, index_js_2.verifyIdentityHeaders)(req.headers, options.secret, { maxSkewMs: options.maxSkewMs });
-    if (result.status === 'authenticated') {
-        req.user = result.user;
-        return 'ok';
-    }
-    if (result.status === 'invalid') {
-        options.logger?.warn('Rejected forged or stale gateway identity', { reason: result.reason, path: req.path });
-        return 'invalid';
-    }
-    return 'anonymous';
+const middleware_js_1 = require("./middleware.js");
+const index_js_2 = require("../context/index.js");
+const index_js_3 = require("../identity/index.js");
+/** Collapses the user's scope id lists into the request context's `key → id` map (lists are comma-joined). */
+function contextScopes(user) {
+    return Object.fromEntries(Object.entries(user.scopes).filter(([, ids]) => ids.length).map(([key, ids]) => [key, ids.join(',')]));
 }
-/** Requires a valid gateway-signed identity; 401 otherwise. */
+function createResolver(options) {
+    const secret = (0, index_js_3.assertGatewaySecret)(options.secret ?? process.env.GATEWAY_SIGNING_SECRET);
+    const reject = (req, reason) => {
+        const event = { reason, method: req.method, path: (0, index_js_3.canonicalPath)(req.originalUrl), requestId: (0, middleware_js_1.correlationId)(req) };
+        options.logger?.warn('Rejected gateway identity', { reason, method: event.method, path: event.path });
+        if (!options.onRejected)
+            return;
+        Promise.resolve()
+            .then(() => options.onRejected?.(event, req))
+            .catch((error) => options.logger?.error('Identity onRejected hook failed', { error: error.message }));
+    };
+    return (req) => {
+        const result = (0, index_js_3.verifyGatewayIdentity)({
+            headers: req.headers, method: req.method, path: req.originalUrl, secret, protocol: options.protocol,
+            maxAgeMs: options.maxAgeMs, maxFutureMs: options.maxFutureMs,
+        });
+        if (result.status === 'authenticated') {
+            req.user = result.user;
+            (0, index_js_2.updateRequestContext)({ userId: result.user.id, scopes: contextScopes(result.user) });
+            return 'ok';
+        }
+        if (result.status === 'invalid')
+            reject(req, result.reason);
+        return result.status === 'invalid' ? 'invalid' : 'anonymous';
+    };
+}
+const unauthenticated = (req, res, message = 'Authentication required') => res.status(401).json((0, response_js_1.errorBody)('UNAUTHENTICATED', message, { requestId: (0, middleware_js_1.correlationId)(req) }));
+/**
+ * Requires a valid gateway-signed (v2) identity and sets `req.user`; 401 UNAUTHENTICATED (with `requestId`)
+ * otherwise. Also fills the request context's `userId` and `scopes` so log lines carry them.
+ * Throws at startup when the secret is missing or shorter than 32 characters.
+ *
+ * @param options Protocol, secret, replay window, logger and rejection hook.
+ * @returns Express middleware.
+ * @example router.use(authenticateFromGateway({ protocol, logger, onRejected: publishSecurityEvent }));
+ */
 function authenticateFromGateway(options) {
+    const resolve = createResolver(options);
     return (req, res, next) => {
-        if (resolveIdentity(req, options) === 'ok')
+        if (resolve(req) === 'ok')
             return next();
-        res.status(401).json((0, response_js_1.errorResponse)('Authentication required', undefined, 'UNAUTHENTICATED'));
+        unauthenticated(req, res);
     };
 }
-/** Attaches `req.user` when a valid identity is present; continues anonymously otherwise. */
+/**
+ * Attaches `req.user` when a valid identity is present and continues anonymously when none is sent,
+ * for public routes that personalise. A forged or stale identity is still rejected with 401, never
+ * downgraded to anonymous.
+ *
+ * @param options Same as {@link authenticateFromGateway}.
+ * @returns Express middleware.
+ * @example router.get('/items', optionalAuthFromGateway({ protocol }), controller.list);
+ */
 function optionalAuthFromGateway(options) {
+    const resolve = createResolver(options);
     return (req, res, next) => {
-        if (resolveIdentity(req, options) === 'invalid') {
-            res.status(401).json((0, response_js_1.errorResponse)('Invalid identity', undefined, 'UNAUTHENTICATED'));
-            return;
-        }
+        if (resolve(req) === 'invalid')
+            return unauthenticated(req, res, 'Invalid identity');
         next();
     };
 }
 function guard(check, message = 'You do not have permission to perform this action') {
     return (req, res, next) => {
-        if (!req.user) {
-            res.status(401).json((0, response_js_1.errorResponse)('Authentication required', undefined, 'UNAUTHENTICATED'));
-            return;
-        }
+        if (!req.user)
+            return unauthenticated(req, res);
         if (!check(req.user)) {
-            res.status(403).json((0, response_js_1.errorResponse)(message, undefined, 'FORBIDDEN'));
+            res.status(403).json((0, response_js_1.errorBody)('FORBIDDEN', message, { requestId: (0, middleware_js_1.correlationId)(req) }));
             return;
         }
         next();
     };
 }
-/** Allows callers holding any of `permissions`. */
+/**
+ * Allows callers holding any of `permissions` (401 without identity, 403 FORBIDDEN otherwise).
+ * A super admin passes every permission guard.
+ *
+ * @example router.post('/refunds', requirePermission('refunds.create'), controller.create);
+ */
 const requirePermission = (...permissions) => guard((u) => (0, index_js_1.hasPermission)(u, ...permissions));
 exports.requirePermission = requirePermission;
-/** Allows callers holding every one of `permissions`. */
-const requireAllPermissions = (...permissions) => guard((u) => (0, index_js_1.hasAllPermissions)(u, ...permissions));
+/**
+ * Allows callers holding every one of `permissions`. Accepts a list or rest arguments.
+ *
+ * @example router.delete('/x/:id', requireAllPermissions('x.read', 'x.delete'), controller.remove);
+ */
+const requireAllPermissions = (...permissions) => {
+    const required = permissions.flat();
+    return guard((u) => (0, index_js_1.hasAllPermissions)(u, ...required));
+};
 exports.requireAllPermissions = requireAllPermissions;
-/** Allows callers with any of `roles`. Prefer permissions; roles are for coarse gates only. */
+/**
+ * Allows callers whose session passed the one-time-code (second factor) check; 403 FORBIDDEN otherwise.
+ *
+ * @example router.post('/security/settings', requireOtpVerified(), controller.update);
+ */
+const requireOtpVerified = () => guard((u) => u.otpVerified === true, 'One-time code verification is required');
+exports.requireOtpVerified = requireOtpVerified;
+/**
+ * Allows callers with any of `roles`. Prefer permissions; roles are for coarse gates only.
+ *
+ * @example router.use('/ops', requireRole('platform_admin'));
+ */
 const requireRole = (...roles) => guard((u) => (0, index_js_1.hasRole)(u, ...roles), 'Insufficient role');
 exports.requireRole = requireRole;
-/** Guards `/internal/*` routes: requires the shared service secret header. */
-function requireInternalServiceSecret(secret) {
-    return (req, res, next) => {
-        const provided = req.headers[index_js_2.CONTEXT_HEADERS.INTERNAL_SECRET];
-        if (typeof provided === 'string' && secret && (0, crypto_js_1.safeEqual)(provided, secret))
-            return next();
-        res.status(401).json((0, response_js_1.errorResponse)('Invalid internal service credentials', undefined, 'UNAUTHENTICATED'));
-    };
-}
 //# sourceMappingURL=auth.js.map

package/dist/cjs/express/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/express/auth.ts"],"names":[],"mappings":";;;AAoCA,0DAKC;AAGD,0DAQC;AA0BD,oEAMC;AAnFD,iDAA+E;AAC/E,mDAAgD;AAChD,uDAAsD;AACtD,mDAA8E;AAkB9E,SAAS,eAAe,CAAC,GAAY,EAAE,OAA2B;IAChE,MAAM,MAAM,GAAG,IAAA,gCAAqB,EAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACpG,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,2CAA2C,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7G,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,+DAA+D;AAC/D,SAAgB,uBAAuB,CAAC,OAA2B;IACjE,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,EAAE,CAAC;QAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAA,2BAAa,EAAC,yBAAyB,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC/F,CAAC,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,SAAgB,uBAAuB,CAAC,OAA2B;IACjE,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAA,2BAAa,EAAC,kBAAkB,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,KAAkC,EAAE,OAAO,GAAG,mDAAmD;IAC9G,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAA,2BAAa,EAAC,yBAAyB,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC;YAC7F,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAA,2BAAa,EAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,mDAAmD;AAC5C,MAAM,iBAAiB,GAAG,CAAC,GAAG,WAAqB,EAAkB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,wBAAa,EAAC,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC;AAAjH,QAAA,iBAAiB,qBAAgG;AAE9H,yDAAyD;AAClD,MAAM,qBAAqB,GAAG,CAAC,GAAG,WAAqB,EAAkB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,4BAAiB,EAAC,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC;AAAzH,QAAA,qBAAqB,yBAAoG;AAEtI,+FAA+F;AACxF,MAAM,WAAW,GAAG,CAAC,GAAG,KAAe,EAAkB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,kBAAO,EAAC,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE,mBAAmB,CAAC,CAAC;AAA9G,QAAA,WAAW,eAAmG;AAE3H,8EAA8E;AAC9E,SAAgB,4BAA4B,CAAC,MAAc;IACzD,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,0BAAe,CAAC,eAAe,CAAC,CAAC;QAC9D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,IAAI,IAAA,qBAAS,EAAC,QAAQ,EAAE,MAAM,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACzF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAA,2BAAa,EAAC,sCAAsC,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC5G,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/express/auth.ts"],"names":[],"mappings":";;;AAwFA,0DAMC;AAWD,0DAMC;AA9GD,iDAA+E;AAC/E,uDAAkD;AAClD,mDAAgD;AAChD,kDAA2D;AAC3D,mDAE8B;AAuC9B,8GAA8G;AAC9G,SAAS,aAAa,CAAC,IAAc;IACnC,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACnI,CAAC;AAED,SAAS,cAAc,CAAC,OAA2B;IACjD,MAAM,MAAM,GAAG,IAAA,8BAAmB,EAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACzF,MAAM,MAAM,GAAG,CAAC,GAAY,EAAE,MAAyB,EAAE,EAAE;QACzD,MAAM,KAAK,GAA0B,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAA,wBAAa,EAAC,GAAG,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,IAAA,6BAAa,EAAC,GAAG,CAAC,EAAE,CAAC;QACzI,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACtG,IAAI,CAAC,OAAO,CAAC,UAAU;YAAE,OAAO;QAChC,OAAO,CAAC,OAAO,EAAE;aACd,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;aAC5C,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,iCAAiC,EAAE,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC9H,CAAC,CAAC;IACF,OAAO,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,MAAM,GAAG,IAAA,gCAAqB,EAAC;YACnC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ;YACnG,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;SAC7D,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YACtC,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACvB,IAAA,+BAAoB,EAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACrF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5D,OAAO,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;IAC/D,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,CAAC,GAAY,EAAE,GAAa,EAAE,OAAO,GAAG,yBAAyB,EAAE,EAAE,CAC3F,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAA,uBAAS,EAAC,iBAAiB,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,IAAA,6BAAa,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AAEjG;;;;;;;;GAQG;AACH,SAAgB,uBAAuB,CAAC,OAA2B;IACjE,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,EAAE,CAAC;QACzC,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5B,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,uBAAuB,CAAC,OAA2B;IACjE,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,OAAO,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACrF,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,KAAkC,EAAE,OAAO,GAAG,mDAAmD;IAC9G,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,CAAC,GAAG,CAAC,IAAI;YAAE,OAAO,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAA,uBAAS,EAAC,WAAW,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,IAAA,6BAAa,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACI,MAAM,iBAAiB,GAAG,CAAC,GAAG,WAAqB,EAAkB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,wBAAa,EAAC,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC;AAAjH,QAAA,iBAAiB,qBAAgG;AAE9H;;;;GAIG;AACI,MAAM,qBAAqB,GAAG,CAAC,GAAG,WAAqC,EAAkB,EAAE;IAChG,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;IACpC,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,4BAAiB,EAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;AACzD,CAAC,CAAC;AAHW,QAAA,qBAAqB,yBAGhC;AAEF;;;;GAIG;AACI,MAAM,kBAAkB,GAAG,GAAmB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,EAAE,wCAAwC,CAAC,CAAC;AAA1H,QAAA,kBAAkB,sBAAwG;AAEvI;;;;GAIG;AACI,MAAM,WAAW,GAAG,CAAC,GAAG,KAAe,EAAkB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,kBAAO,EAAC,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE,mBAAmB,CAAC,CAAC;AAA9G,QAAA,WAAW,eAAmG"}

package/dist/cjs/express/index.js

@@ -18,4 +18,7 @@ __exportStar(require("./auth.js"), exports);
 __exportStar(require("./middleware.js"), exports);
 __exportStar(require("./health.js"), exports);
 __exportStar(require("./security.js"), exports);
+__exportStar(require("./respond.js"), exports);
+__exportStar(require("./step-up.js"), exports);
+__exportStar(require("./internal-caller.js"), exports);
 //# sourceMappingURL=index.js.map

package/dist/cjs/express/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/express/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAA0B;AAC1B,kDAAgC;AAChC,8CAA4B;AAC5B,gDAA8B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/express/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAA0B;AAC1B,kDAAgC;AAChC,8CAA4B;AAC5B,gDAA8B;AAC9B,+CAA6B;AAC7B,+CAA6B;AAC7B,uDAAqC"}

package/dist/cjs/express/internal-caller.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createInternalCallerGuards = createInternalCallerGuards;
+const response_js_1 = require("../common/response.js");
+const internal_service_auth_js_1 = require("../common/internal-service-auth.js");
+const index_js_1 = require("../identity/index.js");
+const middleware_js_1 = require("./middleware.js");
+const isUnderPrefix = (path, prefix) => path === prefix || path.startsWith(`${prefix}/`);
+/**
+ * Builds the internal-caller guard for a service, bound to its internal path prefix and accepted credentials.
+ *
+ * @param options Path prefix, credentials and logger.
+ * @returns `{ requireInternalCaller }`.
+ * @throws Error when the prefix is not an absolute path; ConfigError when env credentials are malformed.
+ * @example
+ * const { requireInternalCaller } = createInternalCallerGuards({ pathPrefix: '/internal', logger });
+ * router.get('/internal/records/:id', requireInternalCaller(['alpha-service']), controller.get);
+ */
+function createInternalCallerGuards(options) {
+    const prefix = options.pathPrefix.replace(/\/+$/, '');
+    if (!prefix.startsWith('/'))
+        throw new Error('createInternalCallerGuards: pathPrefix must be an absolute path such as /internal');
+    const credentials = options.credentials ?? (0, internal_service_auth_js_1.internalServiceAuthConfigFromEnv)().credentials;
+    return {
+        requireInternalCaller(allowed) {
+            if (!allowed.length)
+                throw new Error('requireInternalCaller: list at least one caller');
+            const callers = [...allowed];
+            return (req, res, next) => {
+                const path = (0, index_js_1.canonicalPath)(req.originalUrl);
+                const requestId = (0, middleware_js_1.correlationId)(req);
+                if (!isUnderPrefix(path, prefix)) {
+                    options.logger?.warn('Internal guard outside the internal prefix', { path });
+                    res.status(403).json((0, response_js_1.errorBody)('FORBIDDEN', 'Not an internal route', { requestId }));
+                    return;
+                }
+                const verdict = (0, internal_service_auth_js_1.verifyInternalCaller)({ headers: req.headers, credentials, allowed: callers });
+                if (verdict.ok) {
+                    req.internalCaller = verdict.caller;
+                    return next();
+                }
+                options.logger?.warn('Rejected internal caller', { reason: verdict.reason, caller: verdict.caller, path });
+                if (verdict.status === 401) {
+                    res.status(401).json((0, response_js_1.errorBody)('UNAUTHENTICATED', 'Invalid internal service credentials', { requestId }));
+                    return;
+                }
+                res.status(403).json((0, response_js_1.errorBody)('FORBIDDEN', 'This service may not call this route', { requestId }));
+            };
+        },
+    };
+}
+//# sourceMappingURL=internal-caller.js.map

package/dist/cjs/express/internal-caller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-caller.js","sourceRoot":"","sources":["../../../src/express/internal-caller.ts"],"names":[],"mappings":";;AA8DA,gEA+BC;AAjFD,uDAAkD;AAClD,iFAA4G;AAC5G,mDAAqD;AAErD,mDAAgD;AAkChD,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,MAAc,EAAW,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;AAElH;;;;;;;;;GASG;AACH,SAAgB,0BAA0B,CAAC,OAAmC;IAC5E,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;IAClI,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAA,2DAAgC,GAAE,CAAC,WAAW,CAAC;IAE1F,OAAO;QACL,qBAAqB,CAAC,OAAO;YAC3B,IAAI,CAAC,OAAO,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACxF,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;YAC7B,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;gBACzD,MAAM,IAAI,GAAG,IAAA,wBAAa,EAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAC5C,MAAM,SAAS,GAAG,IAAA,6BAAa,EAAC,GAAG,CAAC,CAAC;gBACrC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;oBACjC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,4CAA4C,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC7E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAA,uBAAS,EAAC,WAAW,EAAE,uBAAuB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;oBACrF,OAAO;gBACT,CAAC;gBACD,MAAM,OAAO,GAAG,IAAA,+CAAoB,EAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC9F,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;oBACf,GAAG,CAAC,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC;oBACpC,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBACD,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3G,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC3B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAA,uBAAS,EAAC,iBAAiB,EAAE,sCAAsC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;oBAC1G,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAA,uBAAS,EAAC,WAAW,EAAE,sCAAsC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;YACtG,CAAC,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}